USAP framework forces AI security tools to cite verifiable evidence for every verdict

·1 views

A developer has built USAP, an open-source AI security analysis framework, to address a core flaw in existing LLM-based security tools: the inability to distinguish correct verdicts from confidently wrong ones. USAP enforces an output contract requiring every security verdict to include at least one resolvable evidence reference, rejecting vague citations like 'the SIEM showed it' at the contract boundary. The system supports live MCP sources, external references such as CVEs, operator artifacts, and in-repo standards, and degrades gracefully to an UNKNOWN status rather than fabricating data when a source is unavailable. Metrics like CVSS scores and EPSS ratings are computed directly from published vectors and live feeds, with the contract rejecting any figures that contradict their cited sources. Released under the Apache-2.0 license, USAP runs as an MCP server or as system prompts and ships with a benchmark corpus covering real incidents like Log4Shell and MOVEit to enable objective performance evaluation.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI-Assisted Security Review of Ory Kratos Finds Authorization Boundaries Intact

A source-code-only security review of Ory Kratos, an open-source identity and user-management server licensed under Apache 2.0, used AI to generate five authorization-related hypotheses rather than produce direct vulnerability reports. The review methodology inverted the typical AI security workflow: the AI over-generated candidate weaknesses cheaply, while the human reviewer's task was to systematically eliminate each one. All five hypotheses — covering admin API authorization, cross-identity data leaks, token reuse, settings-flow identity confusion, and tenant boundary bypass — were killed after tracing the codebase and finding deliberate architectural safeguards. Key protections identified included deployment-layer admin API authorization, a centralized network-ID-based data filter enforced at the database layer, and server-side session identity binding. The review explicitly limits its claims to the public OSS repository and does not assert that Kratos is vulnerability-free, emphasizing that the value lies in the method and the documented kill table rather than any finding.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guide Released for Compiling OBS Studio 32.x from Source on Debian Trixie

A technical guide has been published detailing how to build OBS Studio version 32.1.2 and above from source code on Debian Trixie (version 13). The process covers enabling advanced features including Browser Source via the Chromium Embedded Framework, WebSocket, WebRTC through libdatachannel, and NVIDIA NVENC hardware encoding using SDK 12.2. Because Debian Trixie does not package all required library versions, several dependencies such as libdatachannel and FFnvcodec headers must be compiled manually from source. The guide also notes that users running NVIDIA's 550.x driver branch should specifically use the sdk/12.2 branch of nv-codec-headers to prevent runtime crashes. The build uses the Ninja build system alongside Qt6, FFmpeg, Wayland, and PipeWire support, with OBS configured to install into a local directory rather than system-wide.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Newly Self-Employed Workers Can Handle Quarterly Estimated Taxes Solo

Freelancers and gig workers who leave traditional employment must pay federal taxes quarterly — roughly in April, June, September, and January — since no employer withholds taxes on their behalf. Beyond income tax, self-employed individuals owe a 15.3% self-employment tax covering Social Security and Medicare, a charge that often catches new freelancers off guard. The IRS offers a "safe harbor" rule that protects workers from underpayment penalties if they prepay at least 90% of this year's tax liability or 100% of last year's. Financial experts suggest setting aside 25–30% of every client payment into a dedicated savings account to ensure funds are available when quarterly deadlines arrive. Understanding a few core rules — including safe harbor thresholds and self-employment tax obligations — can help most new solo workers manage their taxes without hiring a professional accountant.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS Adds EKS Version Rollback, Changing How Teams Approach Kubernetes Upgrades

AWS this week introduced a version rollback feature for its Elastic Kubernetes Service (EKS), allowing clusters to revert by one minor version within a limited time window. The feature includes automated readiness checks and, in Auto Mode, supports worker node rollback as part of the process. For years, teams had no formal recovery primitive for failed cluster upgrades, relying instead on staging environments, compatibility checks, and a general expectation of fixing issues forward. Rollback reframes upgrade planning by making recovery an explicit part of the process, prompting teams to separate control-plane and data-plane changes and define clear checkpoints. Salesforce's experience, cited in the AWS announcement, highlights that restructuring the upgrade sequence is often necessary to fully benefit from the rollback capability.

0 comments Read more at DEV Community